PSF-2026-9: SourcelessFileLoader does not use io.open_code()

Published Mar 4, 2026

Updated

The import hook in CPython that handles legacy .pyc files (SourcelessFileLoader) is incorrectly handled in FileLoader (a base class) and so does not use io.opencode() to read the .pyc files. sys.audit handlers for this audit event therefore do not fire.

Affected Software

1 affected component

Python Software Foundation CPython

Event History

Mar 4, 2026

CVE Published

via OSV·10:10 PM

Data Sourced

via OSV·10:10 PM

DescriptionSeverity

Frequently Asked Questions

Who is affected in practice?

CPython deployments that use legacy .pyc files through SourcelessFileLoader and rely on sys.audit handlers to observe io.open_code() events are affected. The issue is local in scope and requires low privileges according to the provided vector.

What security control is bypassed?

Audit handlers registered through sys.audit do not receive the expected audit event when SourcelessFileLoader reads legacy .pyc files, because the loader does not use io.open_code(). This can leave those handlers without visibility into that code-loading path.

How can I determine whether my monitoring is affected?

Review whether your CPython environment loads legacy .pyc files via SourcelessFileLoader and whether your detection or policy logic depends on sys.audit events generated by io.open_code(). If both are true, that monitoring path does not fire for those reads.

PSF-2026-9: SourcelessFileLoader does not use io.open_code()

Affected Software

Event History

Frequently Asked Questions

Who is affected in practice?

What security control is bypassed?

How can I determine whether my monitoring is affected?

Company

Resources

Contact

Frequently Asked Questions

Who is affected in practice?

What security control is bypassed?

How can I determine whether my monitoring is affected?